zip-rs: Denial of service via unchecked ZIP64 allocation (CVE-2026-115907)

The zip-rs library, specifically when the 'legacy-zip' feature is enabled, contains a vulnerability that allows an attacker to trigger an unhandled panic by supplying a maliciously crafted ZIP archive. The library preallocates output memory based on the ZIP64 uncompressed size field before validating the integrity of the compressed data. This vulnerability affects the Shrink, Reduce, and Implode decoders within the library. If an archive-processing service attempts to extract such a file, the resulting capacity overflow leads to a panic and subsequent termination of the service. This issue is resolved in version 9.0.0.

Impact

Successful exploitation results in a denial-of-service condition for the application or service consuming the library, as the unhandled panic terminates the processing thread or the entire service process.

Recommendation

• Update the zip-rs crate to version 9.0.0 or later to ensure the library properly validates compressed stream data before allocating output capacity.
• Audit applications using the 'legacy-zip' feature to determine if they are exposed to untrusted user-supplied ZIP files.
• Implement memory limits or resource constraints on containerized or service-level environments that process uploaded archives to mitigate the impact of unexpected allocation attempts.